cmd/go: add tool meta-pattern to go help packages

For #48429

Change-Id: I6932853c3156a68d099a749431d15d2c37785649
Reviewed-on: https://go-review.googlesource.com/c/go/+/632555
Reviewed-by: Sam Thanawalla <samthanawalla@google.com>
Auto-Submit: Sam Thanawalla <samthanawalla@google.com>
Reviewed-by: Michael Matloob <matloob@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

cmd/go: report tool errors in go list all

Before tools there was no way to directly import a package in another
module, and so missing packages were always marked as "all" due to being
dependencies of a package in a main module.

Tools break that assumption, and so to report errors in tool packages
correctly we need to mark packages as being in "all" even if they do not
exist.

Fixes #70582

Change-Id: I3273e0ec7910894565206de77986f5c249a5658c
Reviewed-on: https://go-review.googlesource.com/c/go/+/634155
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Sam Thanawalla <samthanawalla@google.com>
Reviewed-by: Michael Matloob <matloob@golang.org>

cmd/go: use AppendPath(OrigEnv) as env for tool executable

Before this change, when go tool wass used to start a tool defined in a
go.mod tool directive, it used the environment the go command was
running in. The issue with doing that is that the go command sets
various environment variables from the computed environment when
invoking a subcommand. That is used to standardise the environment for
the various tools invoked by the go command, but it is not the
expectatation of tools invoked by the go command, especially since those
environment variables may change the behavior of the tool run. Instead
use the same environment we use in go run to start the executable: the
original environment (with minor modifications) saved before we start
explicitly setting the envornment, with GOROOT/bin added to the path so
that sub commands that run the go tool use the proper go tool binary.

Fixes #70544

Change-Id: Ifbf0040a2543113638eec7232323eb9de1d61529
Reviewed-on: https://go-review.googlesource.com/c/go/+/631836
Reviewed-by: Conrad Irwin <conrad.irwin@gmail.com>
Reviewed-by: Sean Liao <sean@liao.dev>
Reviewed-by: Sam Thanawalla <samthanawalla@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

all: update vendored dependencies [generated]

The Go 1.24 RC is due for next week. This is a time to once again update
all golang.org/x/... module versions that contribute packages to the
std and cmd modules in the standard library to latest master versions.

For #36905.

[git-generate]
go install golang.org/x/build/cmd/updatestd@latest
go install golang.org/x/tools/cmd/bundle@latest
updatestd -goroot=$(pwd) -branch=master

Change-Id: If4fd03a18590ff3b6e701a9698370c57c69979c2
Reviewed-on: https://go-review.googlesource.com/c/go/+/634041
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>

cmd/go: consistently use DefaultExecName for executable name

go tool, go run, and the executable caching logic have all used
path.Base of a package's import path to set the name of the executable
produced. But the base name for a package name that's the same as a
module name ending in a major version is just that major version, which
is not very useful. For go build and go install, we use
load.DefaultExecName as the name of the binary which will select the
second to last element of the import path as the name of the executable
produced. This change changes go tool, go run, and the executable
caching logic to all use DefaultExecName consistently to pick the name
of the executable.

Change-Id: I8e615bbc6a4f9cc4549165c31954fab181d63318
Reviewed-on: https://go-review.googlesource.com/c/go/+/634039
Reviewed-by: Sam Thanawalla <samthanawalla@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Conrad Irwin <conrad.irwin@gmail.com>

cmd/go: add -modfile and -modcacherw to go tool

When adding support for module tools, we added the ability for `go tool`
to edit the module cache. For users with `GOFLAGS=-modcacherw` this
could have led to a situation where some of the files in the mod cache
were unexpectedly not deletable.

We also allow -modfile so that people can select which module they are
working in when looking for tools.

We still do not support arbitrary build flags for tools with `go tool`.
If you want those, use `go run` or `go build`, etc. instead.

Updates #48429

Change-Id: Ic3c56bb8b6ba46114196465ca6ee2dcb08b9dcc0
Reviewed-on: https://go-review.googlesource.com/c/go/+/632575
Reviewed-by: Michael Matloob <matloob@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Michael Knyszek <mknyszek@google.com>

testing: fix divide by zero when benchmark is faster than OS's clock resolution

I did not added a test because `benchmark_test.go` is `package testing_test`
and I don't care to change that because calling predictN is not testing the
thing I would want to test.

Ideally we would run benchmark in a VM with a highjacked clocksource that never
marches forward, or using faketime but that looks fairly involved for a quickie
fix.

Fixes #70709

Change-Id: I8b4d697aff7cba33da388cb0ae8e2c2b550b9690
Reviewed-on: https://go-review.googlesource.com/c/go/+/633419
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Jorropo <jorropo.pgm@gmail.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Keith Randall <khr@golang.org>
Reviewed-by: Keith Randall <khr@google.com>

cmd/compile: update default PGO profile

Since last time the default.pgo profile is collected, there has
been a lot of development in the compiler. It's time to refresh
the compiler's PGO profile.

Profile collected by running the cmd/compile/profile.sh script on
the gotip-linux-arm64_c4ah72-perf_vs_release gomote.

Benchmark results on Linux/AMD64:

         │   nopgo.txt   │              old.txt               │              new.txt               │
         │    sec/op     │   sec/op     vs base               │   sec/op     vs base               │
Template     112.0m ± 1%   109.7m ± 1%  -2.10% (p=0.000 n=20)   110.3m ± 1%  -1.55% (p=0.001 n=20)
Unicode      99.39m ± 0%   94.94m ± 0%  -4.49% (p=0.000 n=20)   94.33m ± 1%  -5.10% (p=0.000 n=20)
GoTypes      544.9m ± 0%   535.0m ± 1%  -1.80% (p=0.000 n=20)   535.1m ± 0%  -1.78% (p=0.000 n=20)
Compiler     96.23m ± 1%   90.86m ± 1%  -5.58% (p=0.000 n=20)   90.84m ± 1%  -5.60% (p=0.000 n=20)
SSA           3.403 ± 1%    3.273 ± 0%  -3.81% (p=0.000 n=20)    3.247 ± 0%  -4.57% (p=0.000 n=20)
Flate        71.55m ± 0%   70.09m ± 1%  -2.04% (p=0.000 n=20)   70.03m ± 1%  -2.13% (p=0.000 n=20)
GoParser     131.5m ± 1%   129.9m ± 1%  -1.19% (p=0.000 n=20)   129.4m ± 0%  -1.56% (p=0.000 n=20)
Reflect      275.5m ± 1%   268.6m ± 1%  -2.50% (p=0.000 n=20)   268.1m ± 1%  -2.70% (p=0.000 n=20)
Tar          131.6m ± 1%   128.4m ± 1%  -2.37% (p=0.000 n=20)   128.8m ± 1%  -2.07% (p=0.000 n=20)
XML          153.7m ± 1%   150.3m ± 1%  -2.26% (p=0.000 n=20)   149.7m ± 1%  -2.66% (p=0.000 n=20)
geomean      200.3m        194.7m       -2.82%                  194.4m       -2.98%

On Linux/ARM64:

         │   nopgo.txt   │              old.txt               │              new.txt               │
         │    sec/op     │   sec/op     vs base               │   sec/op     vs base               │
Template     82.38m ± 1%   80.52m ± 0%  -2.26% (p=0.000 n=20)   80.07m ± 1%  -2.81% (p=0.000 n=20)
Unicode      76.28m ± 0%   72.72m ± 0%  -4.66% (p=0.000 n=20)   72.40m ± 1%  -5.09% (p=0.000 n=20)
GoTypes      420.7m ± 0%   412.5m ± 0%  -1.95% (p=0.000 n=20)   408.1m ± 1%  -3.00% (p=0.000 n=20)
Compiler     69.85m ± 1%   67.40m ± 1%  -3.50% (p=0.000 n=20)   66.73m ± 1%  -4.47% (p=0.000 n=20)
SSA           2.846 ± 0%    2.733 ± 0%  -3.96% (p=0.000 n=20)    2.707 ± 0%  -4.90% (p=0.000 n=20)
Flate        49.14m ± 1%   47.87m ± 0%  -2.58% (p=0.000 n=20)   47.53m ± 1%  -3.26% (p=0.000 n=20)
GoParser     97.44m ± 1%   94.96m ± 1%  -2.55% (p=0.000 n=20)   94.75m ± 1%  -2.76% (p=0.000 n=20)
Reflect      210.5m ± 0%   205.2m ± 0%  -2.50% (p=0.000 n=20)   202.5m ± 0%  -3.78% (p=0.000 n=20)
Tar          97.75m ± 1%   95.72m ± 1%  -2.07% (p=0.000 n=20)   94.68m ± 1%  -3.13% (p=0.000 n=20)
XML          112.6m ± 0%   110.0m ± 0%  -2.33% (p=0.000 n=20)   108.7m ± 1%  -3.49% (p=0.000 n=20)
geomean      150.2m        145.9m       -2.84%                  144.6m       -3.67%

For #60234.

Change-Id: Ie1abc019339252cd9441a1fb1eab33a29c1dc11c
Reviewed-on: https://go-review.googlesource.com/c/go/+/634037
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Michael Pratt <mpratt@google.com>
Reviewed-by: David Chase <drchase@google.com>

cmd/internal/objabi, internal/runtime: increase nosplit limit on OpenBSD

OpenBSD is bumping up against the nosplit limit, and openbsd/ppc64
is over it. Increase StackGuardMultiplier on OpenBSD, matching AIX.

Change-Id: I61e17c99ce77e1fd3f368159dc4615aeae99e913
Reviewed-on: https://go-review.googlesource.com/c/go/+/632996
Reviewed-by: Keith Randall <khr@golang.org>
Reviewed-by: Keith Randall <khr@google.com>
Auto-Submit: Damien Neil <dneil@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>

crypto/hkdf: add package doc comment

For #61477

Change-Id: I3d3ebf573a21f1f56edfffb3fea53c0b5cbfccd8
Reviewed-on: https://go-review.googlesource.com/c/go/+/634095
Reviewed-by: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>
Auto-Submit: Ian Lance Taylor <iant@golang.org>
Auto-Submit: Ian Lance Taylor <iant@google.com>

doc/next: delete

The release note fragments have been merged and added
as _content/doc/go1.24.md in x/website in CL 634056.

For #68545.

Change-Id: I7b3840df01b8c3699681c0cd21a16af70f74d31d
Reviewed-on: https://go-review.googlesource.com/c/go/+/634057
Auto-Submit: Michael Knyszek <mknyszek@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Michael Knyszek <mknyszek@google.com>

api: promote next to go1.24

Change-Id: Iddede5cbbc7c6cb4335194719b69f49f1d8cd662
Reviewed-on: https://go-review.googlesource.com/c/go/+/634055
Reviewed-by: Michael Knyszek <mknyszek@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Gopher Robot <gobot@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>

testing: improve documentation, examples, release notes for

testing.b.Loop.

This CL added documentation of the no-inlining semantic of b.Loop, with
a concrete example. This CL also tries to improve the release note to be
more descriptive.

Fixes #61515

Change-Id: I1e13cc92d5d6bdbf40fb44f44475e249747b807f
Reviewed-on: https://go-review.googlesource.com/c/go/+/633536
Reviewed-by: Michael Knyszek <mknyszek@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Commit-Queue: Junyang Shao <shaojunyang@google.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>
Reviewed-by: David Chase <drchase@google.com>

cmd/compile: document wasmexport directive, update permitted types for wasmimport

For #65199, #66984.

Change-Id: I9b651a00265fa7d3438d8a73ff04ddca7c4bed99
Reviewed-on: https://go-review.googlesource.com/c/go/+/633776
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>
Reviewed-by: Michael Knyszek <mknyszek@google.com>

cmd/go/testdata/script: skip EndSequence entries in build_trimpath_cgo

The TestScript/build_trimpath_cgo test for cmd/go has been accessing a
nil pointer when it tries to look up LineEntry.File.Name on a line entry
with EndSequence set to true. The doc for EndSequence specifies that if
EndSequence is set, only it and the Address field are meaningful. Skip
the entries with EndSequence set when building the set of files.

Fixes #70669

Change-Id: I421a2a9348e727e3ac4a3d42baa4d206cfbc047b
Reviewed-on: https://go-review.googlesource.com/c/go/+/633038
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>
Reviewed-by: Than McIntosh <thanm@golang.org>

doc/next: introduce module tools

Fixes #48429

Change-Id: Ie1954fc3bedd7d36cafaf3835b6c3a92326393f5
Reviewed-on: https://go-review.googlesource.com/c/go/+/632556
Reviewed-by: Michael Matloob <matloob@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>

crypto/internal/fips140/bigmod: add more //go:norace annotations

//go:norace does not carry over when a function is inlined.
Add //go:norace to functions that inline loops over Nat words.
Improves race tests, also asan, msan.

These are with -race:

goos: darwin
goarch: arm64
pkg: crypto/internal/fips140/bigmod
cpu: Apple M3 Pro
                  │     old      │                 new                 │
                  │    sec/op    │   sec/op     vs base                │
ModAdd-12            172.4n ± 3%   117.9n ± 3%  -31.62% (p=0.000 n=20)
ModSub-12            147.1n ± 2%   111.4n ± 3%  -24.27% (p=0.000 n=20)
NewModulus-12       12.966µ ± 1%   9.743µ ± 2%  -24.86% (p=0.000 n=20)
MontgomeryRepr-12   1305.5n ± 1%   986.3n ± 0%  -24.45% (p=0.000 n=20)
MontgomeryMul-12    1304.0n ± 1%   976.8n ± 0%  -25.10% (p=0.000 n=20)
ModMul-12            2.893µ ± 1%   2.055µ ± 3%  -28.97% (p=0.000 n=20)
ExpBig-12            2.784m ± 0%   2.789m ± 0%   +0.17% (p=0.008 n=20)
Exp-12               3.468m ± 0%   2.620m ± 0%  -24.45% (p=0.000 n=20)
geomean              7.930µ        6.073µ       -23.41%

pkg: crypto/rsa
                             │      old      │                 new                  │
                             │    sec/op     │    sec/op     vs base                │
DecryptPKCS1v15/2048-12         1.795m ±  1%   1.175m ±  1%  -34.52% (p=0.000 n=20)
DecryptPKCS1v15/3072-12         3.836m ±  2%   2.647m ±  0%  -31.01% (p=0.000 n=20)
DecryptPKCS1v15/4096-12         7.316m ±  0%   5.437m ±  0%  -25.68% (p=0.000 n=20)
EncryptPKCS1v15/2048-12         45.85µ ±  1%   34.78µ ±  0%  -24.15% (p=0.000 n=20)
DecryptOAEP/2048-12             1.793m ±  2%   1.188m ±  1%  -33.76% (p=0.000 n=20)
EncryptOAEP/2048-12             55.11µ ±  1%   43.91µ ±  1%  -20.32% (p=0.000 n=20)
SignPKCS1v15/2048-12            1.797m ±  2%   1.193m ±  0%  -33.62% (p=0.000 n=20)
VerifyPKCS1v15/2048-12          45.16µ ±  1%   34.51µ ±  0%  -23.57% (p=0.000 n=20)
SignPSS/2048-12                 1.826m ±  2%   1.213m ±  0%  -33.55% (p=0.000 n=20)
VerifyPSS/2048-12               53.25µ ±  1%   42.40µ ±  1%  -20.36% (p=0.000 n=20)
GenerateKey/2048-12             323.7m ± 33%   209.0m ± 17%  -35.43% (p=0.000 n=20)
ParsePKCS8PrivateKey/2048-12   105.26µ ±  0%   94.74µ ±  0%   -9.99% (p=0.000 n=20)
geomean                         792.5µ         574.3µ        -27.53%

Change-Id: I1f1986cf2bac126d7346799b08b17d356b28d956
Reviewed-on: https://go-review.googlesource.com/c/go/+/633995
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>

doc/next: add release notes for Wasm changes

Document wasmexport and WASI reactor/library mode. Also document
that we now permit more types for wasmimport.

Fixes #65199.
Updates #66984.
For #68545.

Change-Id: Id26a8c9496650cd154daed679b82223af1848eea
Reviewed-on: https://go-review.googlesource.com/c/go/+/634036
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>

cmd/go: drop -v from go help get

Fixes #37301

Change-Id: I6d6ac818a73b907638f62d56bd5a7f00a6e6a5ba
Reviewed-on: https://go-review.googlesource.com/c/go/+/632178
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Michael Knyszek <mknyszek@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Michael Matloob <matloob@golang.org>

embed: document exclusions more explicitly

Fixes #45197
Fixes #45744

Change-Id: Ic221da1b652f693c7aa37287932c0a8726f46765
Reviewed-on: https://go-review.googlesource.com/c/go/+/633815
Reviewed-by: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>
Auto-Submit: Ian Lance Taylor <iant@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

doc/next: add linker change release notes

Document that we now generate GNU build ID or Mach-O UUID by
default, and the related flags to disable or override it.

Fixes #68678.
Fixes #70586.
For #68545.

Change-Id: Ic79f3c05aab8a5032ba6983b8c72eeb4202bfe84
Reviewed-on: https://go-review.googlesource.com/c/go/+/633875
Reviewed-by: David Chase <drchase@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>

weak: fix subheading syntax in package doc

Go doc comments only support one level of heading.

Change-Id: I458f211bc7547a0676a59fdcb72f52ca480bf184
Reviewed-on: https://go-review.googlesource.com/c/go/+/633881
Auto-Submit: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Michael Knyszek <mknyszek@google.com>

weak: massage package docs a little bit

This is an attempt to clarify the "advice" section of the package docs a
little bit and encourage a specific style of use for weak structures.
It's not perfect, but it's something.

Change-Id: Id84b76d207619cc2e78439c5c903ec9575199734
Reviewed-on: https://go-review.googlesource.com/c/go/+/633675
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Carlos Amedee <carlos@golang.org>
Auto-Submit: Michael Knyszek <mknyszek@google.com>

doc/next: add release notes for runtime and sync

Also, move the weak package heading to the end; it currently overlaps
with 1-osroot.md in the sort order.

For #68545.

Change-Id: Ia26ae511eaab7c8762e42d1593ac2197d25bbadb
Reviewed-on: https://go-review.googlesource.com/c/go/+/633599
Reviewed-by: David Chase <drchase@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Michael Knyszek <mknyszek@google.com>

math/bits: update reference to debruijn paper

The old link no longer works.

Fixes #70684

Change-Id: I8711ef7d5721bf20ef83f5192dd0d1f73dda6ce1
Reviewed-on: https://go-review.googlesource.com/c/go/+/633775
Auto-Submit: Ian Lance Taylor <iant@golang.org>
Reviewed-by: Keith Randall <khr@golang.org>
Reviewed-by: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Keith Randall <khr@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

cmd/go/internal/cache: always check error from stat in markUsed

markUsed was not checking that the error from os.Stat was nil before
trying to access the FileInfo entry returned by it. Instead, always
check the error and return false if it's non-nil (usually because the
file does not exist). This can happen if an index entry exists in the
cache, but the output entry it points to does not. markUsed is called at
different points for the index entry and for the output entry, so it's
possible for the index entry to be marked used, and then for another go
process to trim the cache, deleting the output entry.  I'm not sure how
likely that is, or if this is what has been triggering the user observed
instances of #70600, but it's enough for a test case.

Fixes #70600

Change-Id: Ia6be14b4a56736d06488ccf93c3596fff8159f22
Cq-Include-Trybots: luci.golang.try:gotip-linux-amd64-longtest,gotip-windows-amd64-longtest
Reviewed-on: https://go-review.googlesource.com/c/go/+/633037
Reviewed-by: Alan Donovan <adonovan@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

bufio: document Reader must be created with New functions

Fixes #37347

Change-Id: Id642dbe7e52933f8d6cf7116c3c27ddb74efba9d
Reviewed-on: https://go-review.googlesource.com/c/go/+/633315
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Robert Griesemer <gri@google.com>
Reviewed-by: Michael Knyszek <mknyszek@google.com>

sync/atomic: add missing leak tests for And & Or

Theses tests were forgot because when CL 462298 was originally written
And & Or atomics were not available in go.
Git were smart enough to rebase over And's & Or's addition.
After most reviews and before merging it were pointed I should
make theses new intrinsics noescape.
When doing this last minute addition I forgot to add tests.

Change-Id: I457f98315c0aee91d5743058ab76f256856cb782
Reviewed-on: https://go-review.googlesource.com/c/go/+/633416
Reviewed-by: Keith Randall <khr@golang.org>
Reviewed-by: Keith Randall <khr@google.com>
Reviewed-by: David Chase <drchase@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

math/rand/v2: replace <= 0 with == 0 for Uint function docs

This harmonize the docs with (*Rand).Uint* functions.
And it make it clearer, I wasn't sure if it would try to interpret
the uint as a signed number somehow, it does not pull any surprises
make that clear.

Change-Id: I5a87a0a5563dbabfc31e536e40ee69b11f5cb6cf
Reviewed-on: https://go-review.googlesource.com/c/go/+/633535
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Commit-Queue: Ian Lance Taylor <iant@google.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>
Auto-Submit: Ian Lance Taylor <iant@google.com>
Reviewed-by: Robert Griesemer <gri@google.com>

runtime: remove "hall of shame" comment from public documentation

See https://pkg.go.dev/runtime@go1.23.4#FuncForPC

The updated comment uses the same format as bytes.Repeat and math.Float32bits.

Change-Id: Idfbc38645e6b0f03fb07f294c4c79b997d9a01a1
GitHub-Last-Rev: 00fa155c75fb625be84edeadff49276e6cddc42c
GitHub-Pull-Request: golang/go#70671
Reviewed-on: https://go-review.googlesource.com/c/go/+/633475
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>
Auto-Submit: Ian Lance Taylor <iant@google.com>
Reviewed-by: Michael Knyszek <mknyszek@google.com>

sync: document RWMutex locks cannot be upgraded / downgraded

Fixes #38859

Change-Id: I9f4f6fa4cb529aaadfb3812e3a5c0da982a95f68
Reviewed-on: https://go-review.googlesource.com/c/go/+/633415
Auto-Submit: Ian Lance Taylor <iant@google.com>
Reviewed-by: Michael Knyszek <mknyszek@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>

doc/next: minor grammar fix in release notes

For #66626.
For #68545.

Change-Id: I4fe21bdaa9580eb087c849de72e98f6145121dd0
Reviewed-on: https://go-review.googlesource.com/c/go/+/633282
Reviewed-by: Robert Griesemer <gri@google.com>
Auto-Submit: Robert Griesemer <gri@google.com>
Reviewed-by: Alan Donovan <adonovan@google.com>
TryBot-Bypass: Robert Griesemer <gri@google.com>

runtime: avoid defer on system stack in synctestidle_c

Fixes #70661

Change-Id: I58a465cfb1cd16709ffbb072eca0997569540074
Reviewed-on: https://go-review.googlesource.com/c/go/+/633281
Auto-Submit: Damien Neil <dneil@google.com>
Reviewed-by: Michael Pratt <mpratt@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

cmd/link/internal/ld: work around FreeBSD 14.1 cmd/cgo test link failure

On FreeBSD 14.1 we fail to link against C code with internal linking.
The symptom is apparently undefined symbols, but explicitly pointing the
linker at compiler-rt for -libgcc fixes the issue. This looks a lot like
the workaround on OpenBSD, but the symptom is different.
--print-libgcc-file-name produces libclang_rt.builtins-x86_64.a which
appears to be an insufficient subset of libcompiler_rt.a.

For #61095.

Change-Id: Iff5affbc923d69c89d671a69d8f4ecaadac42177
Cq-Include-Trybots: luci.golang.try:gotip-freebsd-amd64
Reviewed-on: https://go-review.googlesource.com/c/go/+/632975
Auto-Submit: Michael Knyszek <mknyszek@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Run-TryBot: Michael Knyszek <mknyszek@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Cherry Mui <cherryyz@google.com>

crypto/internal/fips140/bigmod: disable race detector on tight loops

These kinds of loops over all words of a Nat
were in assembly in math/big, so the race detector
did not instrument them. Now that they are in Go,
they dramatically slow down crypto code under the
race detector. Disable instrumenting them, just like
if they were still in assembly.

goos: darwin
goarch: arm64
cpu: Apple M3 Pro
race: on

pkg: crypto/internal/fips140/bigmod
                  │     old      │                 new                 │
                  │    sec/op    │   sec/op     vs base                │
ModAdd-12           1191.0n ± 1%   164.7n ± 2%  -86.18% (p=0.000 n=30)
ModSub-12           1179.5n ± 5%   145.6n ± 2%  -87.66% (p=0.000 n=30)
MontgomeryRepr-12    2.022µ ± 0%   1.300µ ± 1%  -35.71% (p=0.000 n=30)
MontgomeryMul-12     2.111µ ± 1%   1.302µ ± 0%  -38.34% (p=0.000 n=30)
ModMul-12            4.160µ ± 1%   2.868µ ± 1%  -31.06% (p=0.000 n=30)
ExpBig-12            2.780m ± 0%   2.767m ± 0%   -0.49% (p=0.000 n=30)
Exp-12               8.751m ± 4%   3.451m ± 1%  -60.56% (p=0.000 n=30)
geomean              17.98µ        7.306µ       -59.36%

pkg: crypto/rsa
                             │      old      │                 new                  │
                             │    sec/op     │    sec/op     vs base                │
DecryptPKCS1v15/2048-12         5.537m ±  4%   1.754m ±  1%  -68.32% (p=0.000 n=30)
DecryptPKCS1v15/3072-12        12.153m ±  1%   3.827m ±  1%  -68.51% (p=0.000 n=30)
DecryptPKCS1v15/4096-12        21.889m ±  1%   7.251m ±  1%  -66.87% (p=0.000 n=30)
EncryptPKCS1v15/2048-12         87.98µ ±  0%   45.47µ ±  1%  -48.33% (p=0.000 n=30)
DecryptOAEP/2048-12             5.583m ±  5%   1.777m ±  2%  -68.17% (p=0.000 n=30)
EncryptOAEP/2048-12             98.99µ ±  0%   54.57µ ±  0%  -44.87% (p=0.000 n=30)
SignPKCS1v15/2048-12            5.542m ±  3%   1.756m ±  2%  -68.32% (p=0.000 n=30)
VerifyPKCS1v15/2048-12          84.22µ ±  1%   44.80µ ±  1%  -46.81% (p=0.000 n=30)
SignPSS/2048-12                 5.595m ±  5%   1.799m ±  2%  -67.84% (p=0.000 n=30)
VerifyPSS/2048-12               92.06µ ±  1%   52.72µ ±  1%  -42.73% (p=0.000 n=30)
GenerateKey/2048-12            2744.0m ± 38%   304.1m ± 11%  -88.92% (p=0.000 n=30)
ParsePKCS8PrivateKey/2048-12    888.0µ ±  1%   101.8µ ±  0%  -88.54% (p=0.000 n=30)
geomean                         2.428m         778.5µ        -67.93%

goos: linux
goarch: amd64
cpu: AMD Ryzen 9 7950X 16-Core Processor
race: on

pkg: crypto/internal/fips140/bigmod
                  │     old     │                 new                 │
                  │   sec/op    │   sec/op     vs base                │
ModAdd-32           900.7n ± 3%   124.2n ± 2%  -86.21% (p=0.000 n=30)
ModSub-32           895.5n ± 8%   117.1n ± 1%  -86.92% (p=0.000 n=30)
MontgomeryRepr-32   1.669µ ± 3%   1.038µ ± 1%  -37.82% (p=0.000 n=30)
MontgomeryMul-32    1.646µ ± 4%   1.033µ ± 1%  -37.25% (p=0.000 n=30)
ModMul-32           3.384µ ± 5%   2.124µ ± 1%  -37.22% (p=0.000 n=30)
ExpBig-32           2.573m ± 2%   2.561m ± 1%        ~ (p=0.146 n=30)
Exp-32              7.188m ± 2%   2.746m ± 1%  -61.80% (p=0.000 n=30)
geomean             14.56µ        5.844µ       -59.86%

pkg: crypto/rsa
                             │      old      │                 new                  │
                             │    sec/op     │    sec/op     vs base                │
DecryptPKCS1v15/2048-32         4.111m ±  1%   1.233m ±  1%  -70.00% (p=0.000 n=30)
DecryptPKCS1v15/3072-32         9.443m ±  1%   2.955m ±  1%  -68.70% (p=0.000 n=30)
DecryptPKCS1v15/4096-32        17.261m ±  1%   5.744m ±  1%  -66.72% (p=0.000 n=30)
EncryptPKCS1v15/2048-32         66.31µ ±  1%   36.16µ ±  1%  -45.46% (p=0.000 n=30)
DecryptOAEP/2048-32             4.107m ±  2%   1.241m ±  1%  -69.80% (p=0.000 n=30)
EncryptOAEP/2048-32             72.19µ ±  0%   42.35µ ±  1%  -41.34% (p=0.000 n=30)
SignPKCS1v15/2048-32            4.145m ±  1%   1.257m ±  2%  -69.68% (p=0.000 n=30)
VerifyPKCS1v15/2048-32          65.14µ ±  1%   34.95µ ±  1%  -46.36% (p=0.000 n=30)
SignPSS/2048-32                 4.005m ±  2%   1.271m ±  1%  -68.26% (p=0.000 n=30)
VerifyPSS/2048-32               70.76µ ±  0%   40.72µ ±  1%  -42.46% (p=0.000 n=30)
GenerateKey/2048-32            1946.4m ± 19%   236.3m ± 18%  -87.86% (p=0.000 n=30)
ParsePKCS8PrivateKey/2048-32   713.94µ ±  1%   85.89µ ±  1%  -87.97% (p=0.000 n=30)
geomean                         1.829m         591.5µ        -67.66%

Change-Id: I49cbb6d14b187100bf5e6002e30096667689d852
Reviewed-on: https://go-review.googlesource.com/c/go/+/632978
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>

sort: add examples for SearchStrings, SliceIsSorted

Change-Id: I80b5c99bd8626be6e347f535579c864a565685db
Reviewed-on: https://go-review.googlesource.com/c/go/+/632775
Reviewed-by: Ian Lance Taylor <iant@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Ian Lance Taylor <iant@google.com>
Reviewed-by: Michael Knyszek <mknyszek@google.com>

cmd/compile: fix a premature-deallocation of state in loopreschedchecks

lastMems is free-ed before it's actually used. This results in the pass
breaking: multiple mem phis will present in the instrumented ssa, and
essentially break tighten
pass(https://cs.opensource.google/go/go/+/master:src/cmd/compile/internal/ssa/tighten.go;l=240).

This CL fix that.

Change-Id: I30cf0c3300ed59d1a15d978757a3840fbe04484d
Reviewed-on: https://go-review.googlesource.com/c/go/+/632516
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>

crypto/rsa: return error if keygen random source is broken

Fixes #70643

Change-Id: I47c76500bb2e79b0d1dc096651eb45885f6888b6
Reviewed-on: https://go-review.googlesource.com/c/go/+/632896
Reviewed-by: Russ Cox <rsc@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>

crypto/rsa: fix keys with p < q

Updates #70643

Change-Id: I4aee8373dbddf774564902b3957c6eba11d15fc9
Reviewed-on: https://go-review.googlesource.com/c/go/+/632955
Reviewed-by: Roland Shoemaker <roland@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

crypto/internal/fips140/rsa: add Pairwise Consistency Test

For #69536

Change-Id: I2cbb03fc942f5542b8a26347213304c2a3cb5268
Reviewed-on: https://go-review.googlesource.com/c/go/+/632537
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Michael Knyszek <mknyszek@google.com>

crypto/rsa: allow keys larger than 16384 bits in FIPS mode

Nothing in the standard enforces an upper limit, and we can try
documenting an open range in the Security Policy. Worst case, this is
easy to revert.

For #69536

Change-Id: Id3082e73556fdcd6d2e6c2054c512516e9156c5c
Reviewed-on: https://go-review.googlesource.com/c/go/+/632536
Auto-Submit: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Russ Cox <rsc@golang.org>

crypto/rsa: minor FIPS 186-5 compliance fixes

None of these checks actually matter, and indeed we didn't have them
before, but they are required by FIPS 186-5.

Fixes #69799
For #69536

Change-Id: I5e866962a1b2a31a753053e5b9ec50a3f4c87394
Reviewed-on: https://go-review.googlesource.com/c/go/+/632535
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

hash/maphash, cmd/compile: make Comparable[string] not escape its argument

Currently, maphash.Comparable forces its argument to escape if it
contains a pointer, as we cannot hash stack pointers, which will
change when the stack moves. However, for a string, it is actually
okay if its data pointer points to the stack, as the hash depends
on only the content, not the pointer.

Currently there is no way to write this type-dependent escape
logic in Go code. So we implement it in the compiler as an
intrinsic. The compiler can also recognize not just the string
type, but types whose pointers are all string pointers, and make
them not escape.

Fixes #70560.

Change-Id: I3bf219ad71a238d2e35f0ea33de96487bc8cc231
Reviewed-on: https://go-review.googlesource.com/c/go/+/632715
Reviewed-by: David Chase <drchase@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

cmd/go: add go prefix in base.Fatalf

For #70537

Change-Id: I20e239611f07aa13915367c3a44994a43b5482d7
Reviewed-on: https://go-review.googlesource.com/c/go/+/631535
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Veronica Silina <veronicasilina@google.com>
Reviewed-by: Michael Matloob <matloob@golang.org>

testing: consider -N suffix after benchmark name optional

A "-N" suffix is left out when GOMAXPROCS is 1.

Also match at least 1 space (\s+ instead of \s*), remove trailing '.*'
(it's a no-op), and make the test error message style more consistent
while here.

For #61515.
Fixes #70627.

Change-Id: Id0a17478ac31e2934a663dd0d3b1b37f24974989
Cq-Include-Trybots: luci.golang.try:gotip-plan9-386
Reviewed-on: https://go-review.googlesource.com/c/go/+/632655
Reviewed-by: Junyang Shao <shaojunyang@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Cherry Mui <cherryyz@google.com>

crypto/x509: add missing `be` to comment about serial number positivity

Change-Id: I4e0e5309eb3cb1c6820f1a034a5f52adffe35645
GitHub-Last-Rev: 74b2e89bbdba1b0ec64b22ec7ce0e8f1b071473b
GitHub-Pull-Request: golang/go#70639
Reviewed-on: https://go-review.googlesource.com/c/go/+/632815
Reviewed-by: Michael Knyszek <mknyszek@google.com>
Auto-Submit: Roland Shoemaker <roland@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

crypto/rsa: check hash message length first in SignPKCS1v15

This restores the error checking behavior from Go 1.23.
In particular, the boringcrypto code path now contains this
check again.

Change-Id: Ie38c68c27bc3a95c6a0b5a78fc4196694527cd6b
Reviewed-on: https://go-review.googlesource.com/c/go/+/632495
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>

crypto/internal/fips140/rsa: do trial divisions in key generation

This is optimized to be cheap in terms of extra code and complexity,
rather than performance, so we reuse the GCD we have for inverting d.

Recovers most of the performance loss since CL 630516, although
benchmarking key generation is by nature extremely noisy.

goos: darwin
goarch: arm64
pkg: crypto/rsa
cpu: Apple M2
                   │ 3b42687c56  │           b3d018a1e8-dirty           │
                   │   sec/op    │    sec/op     vs base                │
GenerateKey/2048-8   104.1m ± 7%   139.7m ± 20%  +34.10% (p=0.000 n=20)

Updates #69799
For #69536

Change-Id: I00347610935db8feb0597529a301ad7ace5b2f22
Reviewed-on: https://go-review.googlesource.com/c/go/+/632479
Reviewed-by: Roland Shoemaker <roland@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
Reviewed-by: Russ Cox <rsc@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

crypto/x509: keep RSA CRT values in ParsePKCS1PrivateKey

Turns out that recomputing them (and qInv in particular) in constant
time is expensive, so let's not throw them away when they are available.
They are much faster to check, so we now do that on precompute.

Also, thanks to the opaque crypto/internal/fips140/rsa.PrivateKey type,
we now have some assurance that the values we use are always ones we
checked.

Recovers most of the performance loss since CL 630516 in the happy path.
Also, since now we always use the CRT, if necessary by running a
throwaway Precompute, which is now cheap if PrecomputedValues is filled
out, we effectively fixed the JSON round-trip slowdown (#59695).

goos: darwin
goarch: arm64
pkg: crypto/rsa
cpu: Apple M2
                            │ 3b42687c56  │          f017604bc6-dirty           │
                            │   sec/op    │   sec/op     vs base                │
ParsePKCS8PrivateKey/2048-8   26.76µ ± 1%   65.99µ ± 1%  +146.64% (p=0.002 n=6)

Fixes #59695
Updates #69799
For #69536

Change-Id: I507f8c5a32e69ab28990a3bf78959836b9b08cc9
Reviewed-on: https://go-review.googlesource.com/c/go/+/632478
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>

crypto/rsa: move key generation to crypto/internal/fips140/rsa

It's about 2x slower, but we'll recover that by implementing trial
divisions in a follow-up CL.

Updates #69799
For #69536

Change-Id: Icc02f5a268b658d629bbe7fdaf2a42ad3b259e2c
Reviewed-on: https://go-review.googlesource.com/c/go/+/632477
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

crypto/rsa: move precomputation to crypto/internal/fips140/rsa

We are severely limited by the crypto/rsa API in a few ways:

 - Precompute doesn't return an error, but is the only function allowed
   to modify a PrivateKey.

 - Clients presumably expect the PrecomputedValues big.Ints to be
   populated after Precompute.

 - MarshalPKCS1PrivateKey requires the precomputed values, and doesn't
   have an error return.

 - PrivateKeys with only N, e, and D have worked so far, so they might
   have to keep working.

To move precomputation to the FIPS module, we focus on the happy path of
a PrivateKey with two primes where Precompute is called before anything
else, which match ParsePKCS1PrivateKey and GenerateKey.

There is a significant slowdown in the Parse benchmark due to the
constant-time inversion of qInv. This will be addressed in a follow-up
CL that will use (and check) the value in the ASN.1.

Note that the prime product check now moved to checkPrivateKey is broken
(Π should start at 1 not 0) and fixed in CL 632478.

Updates #69799
For #69536

Change-Id: I95a8bc1244755c6d15d7c4eb179135a15608ddd6
Reviewed-on: https://go-review.googlesource.com/c/go/+/632476
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>

crypto/internal/fips140/rsa: check that e and N are odd

N needs to be odd or we can't call Nat.Exp with it. This was previously
enforced at the Modulus level, but was relaxed in CL 630515.

While at it, also assert that e is odd. If it's even, there is no
possible corresponding private key, and we might as well error out.

Change-Id: I43a6c6e5789683854e4aece650fbf85166b6c318
Reviewed-on: https://go-review.googlesource.com/c/go/+/632475
Reviewed-by: Russ Cox <rsc@golang.org>
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>

crypto/internal/fips140/bigmod: add Nat.InverseVarTime

Will be needed for RSA key generation.

We now require Modulus to be > 1 because we don't want to worry about 1
being out of range. There is no use for a Modulus of 1 anyway, and we
already return an error from NewModulus.

Ported from https://cs.opensource.google/boringssl/boringssl/+/master:crypto/fipsmodule/bn/gcd_extra.cc.inc;drc=5813c2c10c73d800f1b0d890a7d74ff973abbffc.

Updates #69799
For #69536

Change-Id: I9850bcc461565b23fa7186a09c65355f7da3e5ba
Reviewed-on: https://go-review.googlesource.com/c/go/+/632415
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>

crypto/internal/fips140/rsa: add Miller-Rabin test

A following CL will move key generation to crypto/internal/fips140/rsa.

Updates #69799
For #69536

Change-Id: Icdf9b8424da20453939c6587af7dc922aad9e0ca
Reviewed-on: https://go-review.googlesource.com/c/go/+/632215
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Russ Cox <rsc@golang.org>
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>

doc/next: organize 9-todo.md items by category

Most items that need to be done are tracked in release-blocking issues,
but a few are not. Make it easier to understand and track their status.

For #68545.

Change-Id: I1cb31e67d2d868a82ee592c9adb31bc5dd558d67
Reviewed-on: https://go-review.googlesource.com/c/go/+/632195
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>

doc/next: document buildtag changes

Fixes #64127

Change-Id: I1562953caa3b1b2bc5dd3b7692671e0f3d5d2b9b
Reviewed-on: https://go-review.googlesource.com/c/go/+/632355
Commit-Queue: Tim King <taking@google.com>
Reviewed-by: Alan Donovan <adonovan@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

doc/next: document copylock changes

Fixes #66387

Change-Id: Ida9381d1ea83bcceaba460014fac3d0c13ccdbff
Reviewed-on: https://go-review.googlesource.com/c/go/+/632315
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Commit-Queue: Tim King <taking@google.com>
Reviewed-by: Alan Donovan <adonovan@google.com>

doc/next: document that crypto/rand.Read never fails

For #66821

Change-Id: Id9b640a57b9d4d1f9114769f607480b14961e7b3
Reviewed-on: https://go-review.googlesource.com/c/go/+/632036
Reviewed-by: Russ Cox <rsc@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Ian Lance Taylor <iant@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

cmd/preprofile: correct -V flag

Change-Id: I9a0dc3a4b4c81f0f6942badcd4643a74c5046440
GitHub-Last-Rev: d1fa4e51569b1b1b70e4617ac41740cc21d4325a
GitHub-Pull-Request: golang/go#66949
Reviewed-on: https://go-review.googlesource.com/c/go/+/580615
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Ian Lance Taylor <iant@golang.org>
Reviewed-by: qiu laidongfeng2 <2645477756@qq.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>
Reviewed-by: Veronica Silina <veronicasilina@google.com>

go/types, types2: fix printing of error message with variadic calls

Distinguish between variadic signatures and argument lists to
(possibly variadic) functions and place `...` before or after
the last type in the list of types.

Fixes a panic.

Fixes #70526.

Change-Id: I77aba8f50984a21ebcdb62582030f2d0fe0eb097
Reviewed-on: https://go-review.googlesource.com/c/go/+/632275
Reviewed-by: Alan Donovan <adonovan@google.com>
Auto-Submit: Robert Griesemer <gri@google.com>
Reviewed-by: Robert Findley <rfindley@google.com>
Reviewed-by: Robert Griesemer <gri@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

cmd/internal/obj: handle static assembly symbols correctly in FIPS check

Static symbols don't have the package prefix, so we need to identify
them specially.

Change-Id: Iaa0456de802478f6a257164e9703f18f8dc7eb50
Reviewed-on: https://go-review.googlesource.com/c/go/+/631975
Reviewed-by: Cherry Mui <cherryyz@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

debug/elf: check for multiplication overflow for shnum * shentsize

No test case because the problem can only happen for invalid data.
Let the fuzzer find cases like this.

For #47653
Fixes #70584

Change-Id: I8a69a27dcb5b258b88f8e01ebaf0ec20cfcd489b
Reviewed-on: https://go-review.googlesource.com/c/go/+/632035
Reviewed-by: Veronica Silina <veronicasilina@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com>
Auto-Submit: Ian Lance Taylor <iant@golang.org>
Reviewed-by: Cherry Mui <cherryyz@google.com>

doc/next: update with reviewed output from relnote todo

This is the result of running relnote todo today and reviewing its
output. Most of the remaining items that still need to be added to
Go 1.24 release notes are now tracked in release blocking issues.
For a few where it's less clear, I opted to comment on issues.
A good number of items were proposals that affect golang.org/x repos
and don't need to be mentioned in Go 1.24 release notes; they're now
annotated as such.

For #68545.

Change-Id: I4dc7f6d2cf5ab9e68bce83d01413224f80384e2f
Reviewed-on: https://go-review.googlesource.com/c/go/+/631684
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>

os/exec: edit comment to remove invalid link

Update comment to remove link formatting that doesn't turn into a link, because the target field is not a top-level member of the package. Re-word comment slightly.

Change-Id: I43ebd8fb105b772a4362c0c763e6464321a92747
Reviewed-on: https://go-review.googlesource.com/c/go/+/631856
Reviewed-by: Veronica Silina <veronicasilina@google.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>
Auto-Submit: Ian Lance Taylor <iant@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

crypto/tls: fix a broken link

Change-Id: I5d4baa454487a810f138334b613b412a5273311e
Reviewed-on: https://go-review.googlesource.com/c/go/+/631875
Reviewed-by: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>

cmd/trace: also show end stack traces

Fix a regression that appeared in 1.23 when it comes to the stack traces
shown in the trace viewer. In 1.22 and earlier, the viewer was always
showing end stack traces. In 1.23 and later the viewer started to
exclusively show start stack traces.

Showing only the start stack traces made it impossible to see the last
stack trace produced by a goroutine. It also made it hard to understand
why a goroutine went off-cpu, as one had to hunt down the next running
slice of the same goroutine.

Emit end stack traces in addition to start stack traces to fix the
issue.

Fixes #70570

Change-Id: Ib22ea61388c1d94cdbc99fae2d207c4dce011a59
Reviewed-on: https://go-review.googlesource.com/c/go/+/631895
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Michael Pratt <mpratt@google.com>
Auto-Submit: Felix Geisendörfer <felix.geisendoerfer@datadoghq.com>
Reviewed-by: Nick Ripley <nick.ripley@datadoghq.com>
Reviewed-by: Michael Knyszek <mknyszek@google.com>

doc/next: document new language feature (alias type parameters)

For #46477.
For #68545.

Change-Id: I54a36f24167a1f909a865f8f6cf416d7378faa4e
Reviewed-on: https://go-review.googlesource.com/c/go/+/632055
Reviewed-by: Robert Griesemer <gri@google.com>
TryBot-Bypass: Robert Griesemer <gri@google.com>
Auto-Submit: Robert Griesemer <gri@google.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>

doc: add note about crypto/x509 serial generation

Fixes #67675

Change-Id: I102c779c2a0ccaf6572be354fec3153a0a0a32eb
Reviewed-on: https://go-review.googlesource.com/c/go/+/631683
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Roland Shoemaker <roland@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>

doc/next: add notes for new #cgo annotations

Fixes #56378

Change-Id: Ibeaa5aa67e017be0da8797e4c87abf2ee0249db8
Reviewed-on: https://go-review.googlesource.com/c/go/+/632015
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Ian Lance Taylor <iant@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Commit-Queue: Ian Lance Taylor <iant@google.com>

doc/next: add release note for vet on Printf(s) with non-const s

Fixes #60529
Updates #68545

Change-Id: Ica048e4861f4de22deb7f42a1d76eb3151fee986
Reviewed-on: https://go-review.googlesource.com/c/go/+/631682
Auto-Submit: Alan Donovan <adonovan@google.com>
Reviewed-by: Robert Findley <rfindley@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

doc: add note about x509sha1 removal

Fixes #41682

Change-Id: I73aa4991a6df8dfb90720bd66f2a8a53c3ca3504
Reviewed-on: https://go-review.googlesource.com/c/go/+/631677
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Auto-Submit: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

net/http: test for racing idle conn closure and new requests

TestTransportRemovesH2ConnsAfterIdle is experiencing flaky
failures due to a bug in idle connection handling.
Upon inspection, TestTransportRemovesH2ConnsAfterIdle
is slow and (I think) not currently testing the condition
that it was added to test.

Using the new synctest package, this CL:

- Adds a test for the failure causing flakes in this test.
- Rewrites the existing test to use synctest to avoid sleeps.
- Adds a new test that covers the condition the test was
  intended to examine.

The new TestTransportIdleConnRacesRequest exercises the
scenario where a never-used connection is closed by the
idle-conn timer at the same time as a new request attempts
to use it. In this race, the new request should either
successfully use the old connection (superseding the
idle timer) or should use a new connection; it should not
use the closing connection and fail.

TestTransportRemovesConnsAfterIdle verifies that
a connection is reused before the idle timer expires,
and not reused after.

TestTransportRemovesConnsAfterBroken verifies
that a connection is not reused after it encounters
an error. This exercises the bug fixed in CL 196665,
which introduced TestTransportRemovesH2ConnsAfterIdle.

For #70515

Change-Id: Id23026d2903fb15ef9a831b2df71177ea177b096
Reviewed-on: https://go-review.googlesource.com/c/go/+/631795
Reviewed-by: Jonathan Amsterdam <jba@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Damien Neil <dneil@google.com>

net/http: run TestServerShutdownStateNew in a synctest bubble

Took ~12s previously, ~0s now.

Change-Id: I72580fbde73482a40142cf84cd3d78a50afb9f44
Reviewed-on: https://go-review.googlesource.com/c/go/+/630382
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Jonathan Amsterdam <jba@google.com>

net/http: avoid redundant installation of HTTP/2 support in transport

Previously, we'd skip installing the bundled HTTP/2 support
if Transport.TLSNextProto is non-nil.

With the addition of the Transport.Protocols field, we'll
install HTTP/2 if Protocols contains HTTP2, even if TLSNextProto
is non-nil. However, we shouldn't do so if it already contains an
"h2" entry.

Change-Id: Ib086473bb52f1b76d83b1df961d41360c605832c
Reviewed-on: https://go-review.googlesource.com/c/go/+/631395
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Jonathan Amsterdam <jba@google.com>
Auto-Submit: Damien Neil <dneil@google.com>

runtime: using ABIInternal on syscall for riscv64

Change-Id: I550e6b9682df3a3ef75fba6da95c92a30da7bb22
Reviewed-on: https://go-review.googlesource.com/c/go/+/620755
Reviewed-by: Michael Pratt <mpratt@google.com>
Reviewed-by: Michael Knyszek <mknyszek@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

crypto/internal: keep fips140/aes.NewCTR from allocating

Return a *CTR from an always-inlineable function, so the allocation
can be lifted to the callsite.

Put the potentially uninlineable code in a separate function that returns a CTR.

Fixes #70499

Change-Id: I2531a2516e4c00aba65407f3bc24a7c21dd8f842
Reviewed-on: https://go-review.googlesource.com/c/go/+/631317
Reviewed-by: Keith Randall <khr@google.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

crypto/internal/fips140/aes: handle fallback correctly, take 2

Don't fallthrough to the hardware version if we used the generic version.

Missed one case of this in CL 631315.

(Originally broken on CL 624738.)

Change-Id: I5bf485ac8b0007769e4e935794defe2a3592376e
Reviewed-on: https://go-review.googlesource.com/c/go/+/631136
Reviewed-by: Keith Randall <khr@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>
Reviewed-by: Filippo Valsorda <filippo@golang.org>

cmd/go: pass os.Args[0] to mod tools

Fixes #70509

Change-Id: I62952c0ac5de456742b7bee3552a0d90238bfde5
Reviewed-on: https://go-review.googlesource.com/c/go/+/631075
Reviewed-by: Michael Matloob <matloob@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Ian Lance Taylor <iant@golang.org>

all: update vendored dependencies [generated]

The Go 1.24 code freeze has recently started. This is a time to update
all golang.org/x/... module versions that contribute packages to the
std and cmd modules in the standard library to latest master versions.

For #36905.

[git-generate]
go install golang.org/x/build/cmd/updatestd@latest
go install golang.org/x/tools/cmd/bundle@latest
updatestd -goroot=$(pwd) -branch=master

Change-Id: I1b2e3b63ccc1137256d80c882b99ed26a66cbf6b
Reviewed-on: https://go-review.googlesource.com/c/go/+/631336
Reviewed-by: Cherry Mui <cherryyz@google.com>
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
TryBot-Bypass: Dmitri Shuralyov <dmitshur@golang.org>

crypto/internal/fips140/aes: handle fallback correctly

Don't fallthrough to the hardware version if we used the generic version.

This might fix the s390x build on the dashboard.

(Originally broken on CL 624738.)

Change-Id: Idad1f1973a34fc64550ecf0d012651f62bcd6272
Reviewed-on: https://go-review.googlesource.com/c/go/+/631315
Reviewed-by: Keith Randall <khr@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Keith Randall <khr@golang.org>

runtime: properly search for cleanups in cleanup.stop

This change modifies the logic which searches for existing cleanups.
The existing search logic sets the next node to the current node
in certain conditions. This would cause future searches to loop
endlessly. The existing loop could convert non-cleanup specials into
cleanups and cause data corruption.

This also changes where we release the m while we are adding a
cleanup. We are currently holding onto an p-specific gcwork after
releasing the m.

Change-Id: I0ac0b304f40910549c8df114e523c89d9f0d7a75
Reviewed-on: https://go-review.googlesource.com/c/go/+/630278
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Carlos Amedee <carlos@golang.org>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Michael Knyszek <mknyszek@google.com>

crypto/x509: run a subset of the NIST PKI test suite

This vendors the vectors (generated using [0], derived from the
BoringSSL script which generates their test headers) and all of the
certs, but only runs the subset of the suite that is focused on policy
validation.

In the future we may want to run more of the suite, since it is focused
on path validation, not path building, the way it interacts with our
hybrid path builder/validator is kind of complicated.

Updates #68484
Updates #45857

[0] https://gist.github.com/rolandshoemaker/a4efa9d65c2cef74a46ea40f47f0729e

Change-Id: Ic04323dcd76aa5cbd6372c8cb1c44ccb91ccbca4
Reviewed-on: https://go-review.googlesource.com/c/go/+/618415
Reviewed-by: Russ Cox <rsc@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

runtime, internal/synctest, syscall/js: keep bubble membership in syscalls

Propagate synctest bubble membership through syscall/js.Func
functions. Avoids panics from cross-bubble channel operations
in js syscalls.

Fixes #70512

Change-Id: Idbd9f95da8bc4f055a635dfac041359f848dad1a
Reviewed-on: https://go-review.googlesource.com/c/go/+/631055
Reviewed-by: Michael Pratt <mpratt@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Damien Neil <dneil@google.com>

cmd/compile, cmd/link: FIPS fixes for large programs

1. In cmd/internal/obj, only apply the exclusion list to data symbols.
   Text symbols are always fine since they can use PC-relative relocations.

2. In cmd/link, only skip trampolines for text symbols in the same package
   with the same type. Before, all text symbols had type STEXT, but now that
   there are different sections of STEXT, we can only rely on symbols in the
   same package in the same section being close enough not to need
   trampolines.

Fixes #70379.

Change-Id: Ifad2bdd6001ad3b5b23e641127554e9ec374715e
Reviewed-on: https://go-review.googlesource.com/c/go/+/631036
Auto-Submit: Russ Cox <rsc@golang.org>
Reviewed-by: Cherry Mui <cherryyz@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

cmd/dist: don't test FIPS when ASAN is on

CL 627603 added a clear error that FIPS+ASAN doesn't work, and
disabled a test in check_test.go. The :gofips140 test variants
in cmd/dist need to be disabled as well.

Remove a return after testing.T.Skipf since it's unreachable.

For #70321.
Fixes #70496.

Change-Id: Ia53830db1260a817aff1a82cbd91b725e0791437
Cq-Include-Trybots: luci.golang.try:gotip-linux-amd64-asan-clang15
Reviewed-on: https://go-review.googlesource.com/c/go/+/631095
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>

crypto/cipher: deprecate NewOFB, NewCFBDecrypter, and NewCFBEncrypter

Updates #69445

Change-Id: Ie9cd13d65f1f989f24731f8b09bbc5124873549f
Reviewed-on: https://go-review.googlesource.com/c/go/+/631019
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
TryBot-Bypass: Filippo Valsorda <filippo@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>

crypto/tls: implement X25519MLKEM768

This makes three related changes that work particularly well together
and would require significant extra work to do separately: it replaces
X25519Kyber768Draft00 with X25519MLKEM768, it makes CurvePreferences
ordering crypto/tls-selected, and applies a preference to PQ key
exchange methods over key shares (to mitigate downgrades).

TestHandshakeServerUnsupportedKeyShare was removed because we are not
rejecting unsupported key shares anymore (nor do we select them, and
rejecting them actively is a MAY). It would have been nice to keep the
test to check we still continue successfully, but testClientHelloFailure
is broken in the face of any server-side behavior which requires writing
any other messages back to the client, or reading them.

Updates #69985
Fixes #69393

Change-Id: I58de76f5b8742a9bd4543fd7907c48e038507b19
Reviewed-on: https://go-review.googlesource.com/c/go/+/630775
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

net/http: re-enable TestTransportServerProtocols

The h2_bundle.go update was done in CL 631035,
and the test now passes.

Fixes #67816.

Change-Id: Icd54c2774a9e2781e7dc9342ae70c3034eb9bab9
Reviewed-on: https://go-review.googlesource.com/c/go/+/631037
Auto-Submit: Damien Neil <dneil@google.com>
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>

crypto: implement fips140=only mode

Running the test suite in this mode is definitely not an option. Testing
this will probably look like a very long test that tries all functions.
Filed #70514 to track the tests.

For #70123

Change-Id: I6f67de83da37dd1e94e620b7f4f4f6aabe040c41
Reviewed-on: https://go-review.googlesource.com/c/go/+/631018
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

crypto/x509: generate serial number for nil template SerialNumber

Fixes #67675

Change-Id: I976935d20eb6b9adcd19d47bcaeb7abcf78ec5bb
Reviewed-on: https://go-review.googlesource.com/c/go/+/630995
Reviewed-by: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>

crypto/mlkem: init package

This commit exposes the crypto/internal/mlkem package as a public crypto
package based on the linked proposal. Since we've already implemented
this internal to the FIPS boundary this largely defers to that
implementation.

Updates #70122

Change-Id: I5ec9c2783c4d44583244c6d16597704a51e9b738
Reviewed-on: https://go-review.googlesource.com/c/go/+/630240
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>

crypto/fips140: new package

This package holds only the Enabled() function.

Updates #70123

Change-Id: If0e731724d9997001fa52002fa6ae72df4eb16ff
Reviewed-on: https://go-review.googlesource.com/c/go/+/631017
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>

crypto/x509: switch default policy field to Policies

Switch from Certificate.PolicyIdentifiers to Certificate.Policies when
marshalling.

Fixes #67620

Change-Id: Ib627135a569f53d344b4ee2f892ba139506ce0d1
Reviewed-on: https://go-review.googlesource.com/c/go/+/629855
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Roland Shoemaker <roland@golang.org>

crypto/ecdh: revamp FIPS ECDH API

This makes it more similar to the ECDSA API, introducing proper key
types that can correctly "cache" the key check.

The new API also has a better compliance profile. Note how the old
ECDHPnnn functions were not doing the PCT, instead delegating to the
caller an invocation of ImportKeyPnnn.

Change-Id: Ic6cf834427fd790324919b4d92bdaa2aac840016
Reviewed-on: https://go-review.googlesource.com/c/go/+/630098
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>

cmd/compile: use very high budget for once-called closures

This should make it much more likely that rangefunc
iterators become "plain inline code".

Change-Id: I8026603afdc5249f60cc663c4bc15cb1d26d1c83
Reviewed-on: https://go-review.googlesource.com/c/go/+/630696
Reviewed-by: Keith Randall <khr@golang.org>
Auto-Submit: David Chase <drchase@google.com>
Reviewed-by: Keith Randall <khr@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

crypto/sha3: new package

Implement the SHA-3 hash algorithms and the SHAKE extendable output
functions defined in FIPS 202.

This is a wrapper for crypto/internal/fips/sha3 which in turn was ported
from x/crypto/sha3 in CL 616717 as part of #65269.

Fixes #69982

Change-Id: I64ce7f362c1a773f7f5b05f7e0acb4110e52a329
Reviewed-on: https://go-review.googlesource.com/c/go/+/629176
Reviewed-by: Russ Cox <rsc@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>

crypto/rsa: port Validate to bigmod

This is quite a bit slower (almost entirely in the e * d reductions,
which could be optimized), but the slowdown is only 12% of a signature
operation.

Also, call Validate at the end of GenerateKey as a backstop. Key
generation is so incredibly slow that the extra time is negligible.

goos: darwin
goarch: arm64
pkg: crypto/rsa
cpu: Apple M2
                            │  ec9643bbed  │           ec9643bbed-dirty            │
                            │    sec/op    │    sec/op      vs base                │
SignPSS/2048-8                869.8µ ±  1%    870.2µ ±  0%         ~ (p=0.937 n=6)
GenerateKey/2048-8            104.2m ± 17%    106.9m ± 10%         ~ (p=0.589 n=6)
ParsePKCS8PrivateKey/2048-8   28.54µ ±  2%   136.78µ ±  8%  +379.23% (p=0.002 n=6)

Fixes #57751

Co-authored-by: Derek Parker <parkerderek86@gmail.com>
Change-Id: Ifb476859207925a018b433c16dd62fb767afd2d5
Reviewed-on: https://go-review.googlesource.com/c/go/+/630517
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

crypto/rsa: add BenchmarkParsePKCS8PrivateKey and BenchmarkGenerateKey

BenchmarkParsePKCS8PrivateKey is a useful high-level measure of the
performance of Validate + Precompute.

Change-Id: Ibc32bf7006cd6669019dc3c697566614ee348d0f
Reviewed-on: https://go-review.googlesource.com/c/go/+/630516
Reviewed-by: Russ Cox <rsc@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>

crypto/internal/fips/bigmod: add support for even moduli

It doesn't need to be fast because we will only use it for RSA key
generation / precomputation / validation.

Change-Id: If4f5d0d4ac350939b69561e75dec5791db77f68c
Reviewed-on: https://go-review.googlesource.com/c/go/+/630515
Reviewed-by: Russ Cox <rsc@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>

crypto/rsa: refuse to generate and/or use keys smaller than 1024 bits

Fixes #68762

Change-Id: Id89c770571d7cc27c6cf7932139ec3424383a7ef
Reviewed-on: https://go-review.googlesource.com/c/go/+/629938
Reviewed-by: Roland Shoemaker <roland@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>